Research insights on recent Chrome 0day in Skia (CVE-2023-6435) from our lab: 1. The bug is an integer overflow in Skia, an open source library for rendering 2D graphics which which is used in Chromium backend. 2. The bug can be used to escape browser sandbox in Chrome app on Android. 3. At least one more bug -in one of the renderer subsystems, such as v8- is required to complete the attack with a full chain exploit. Google did not disclose the other bug at this time. 4. The bug cannot be used to achieve a full sandbox escape on common desktop deployments of Google Chrome. 5. Based on the above, we hypothesize that the original 0day attack vector and the exploit chain was targeting Android devices specifically. 6. The bug seems to be available and reachable in broad-scope Chromium (including common desktop deployments of Chrome browser), but an additional 3rd vulnerability would be required to execute arbitrary code with the same level of privilege as in the original 0day attack in most popular deployment configurations. Therefore, overal impact of the bug is somewhat scoped. 7. The bug will strongly affect Chrome embedders which use unsandboxed GPU process. We did not look further into this, but Chrome-based systems such as electron framework and derivatives should be patched quickly. 8. The bug is not explicitly related to the previous 0day in Skia (CVE-2023-2136). I.e. it's not a patch bypass of the latter, and not located in the same subsystem of code. 9. Both bugs (6435 and 2136) are focused on bypassing in-code checks, which implicitly suggests the same specialized bughunting workflow, and therefore, possibly the same attacker. 10. The bug is not very trivial to reproduce. Strong familiarity with GPU-level graphics internals is required. Chrome release notes: chromereleases.googleblog.co… Patchset: skia.googlesource.com/skia.g… Issue tracker (restricted): crbug.com/1505053 Analysis by @alisaesage